France blames Iran for fridge sabotage, seeks EU sanctions | Magica
France blames Iran for supermarket fridge sabotage and seeks EU sanctions
Editorial Team
••📖7 min read
France attributes October attacks on roughly 700 retail sites to an Iranian Revolutionary Guard cyber unit. Fires and spoiled food have turned exposed refrigeration controls into a diplomatic and criminal case, while responsibility for later attacks remains unresolved.
France says an Iranian Revolutionary Guard cyber unit sabotaged refrigeration controls at roughly 700 retail sites in October.
Altered defrost settings caused food losses and at least 15 fires, according to French investigators.
New EU sanctions and international arrest warrants are being sought; attribution of later refrigeration attacks remains unresolved.
France on November 9 accused Iran of directing the October sabotage of supermarket refrigeration systems and said it would propose new European sanctions against Iranian individuals and entities. The announcement moves an attack on everyday commercial equipment into a state-level confrontation over physical destruction through computer networks.
In its attribution statement, the foreign ministry identified Shahid Kaveh, a cyber-offensive unit affiliated with the electronic and cyber center of Iran’s Islamic Revolutionary Guard Corps, the country’s paramilitary force. French authorities describe the unit as an industrial-sabotage actor operating through purported hacktivist identities, with targets principally in Israel and the United States as well as Europe. France described the October operation as its first cyber-offensive campaign conducted purely for sabotage on national territory.
The significance lies in the control the attackers obtained: changing an industrial setting was enough to destroy stock and start fires. Yet the scale of the damage does not, by itself, establish that the intrusion required exceptional technical sophistication. Outdated equipment and exposed control systems are central to the account emerging from investigators, vendors and security researchers.
French authorities reported about 700 affected retail sites and at least 15 fire cases; temperatures reached 50 degrees Celsius, according to Associated Press. Source: ANSSI.
Defrost controls became a means of destruction
ANSSI, France’s national cybersecurity agency, says it was alerted on October 12 after attackers compromised refrigeration controllers during the night of October 11–12. They changed defrost parameters to high temperatures, causing merchandise losses and fires in at least 15 cases across a campaign affecting about 700 retail sites, according to its .
N-able says its latest N-central hotfix patches all identified vulnerabilities exploitable without authentication and hosted servers are back online. Further patches, customer-side upgrades and checks for compromise remain necessary after public exploit code prompted a precautionary shutdown.
The foreign ministry estimated food losses in the tens of millions of euros, alongside considerable material damage. The figure estimates lost food, rather than the total cost of all damage. Stores had to discard fresh and frozen goods after temperatures reached 50 degrees Celsius for about six hours, according to a report describing the disruption. Supermarket chain Intermarché separately reported losses of tens of millions of euros in a single day. The chain’s figure and the ministry’s estimate have overlapping scopes and should not be added together.
The affected population extended beyond supermarkets. French authorities identified small butcher shops, a slaughterhouse and cooperative food-processing factories among other victims. They also linked concurrent targeting of Schneider Electric equipment at small French hydroelectric installations to the same attack, reporting moderate effects there. The differing outcomes matter: access to industrial controls did not produce uniform destruction across every target.
Danfoss, the Danish supplier whose remote refrigeration-control software was identified as an entry point, said the affected software involved older versions that users had not updated or that had become obsolete, according to a report on the investigation. That is the supplier’s account of the affected systems, not a complete explanation of how every victim was breached.
Saher Naumaan, a senior threat researcher at cybersecurity company Proofpoint, assessed the sabotage as less a demonstration of Iranian cyber capability than of the systems’ exposure, in a report on the attribution.
A state attribution with a longer industrial-control history
France’s attribution draws on work by the Centre de Coordination des Crises Cyber (C4), an interministerial cyber-crisis coordination body combining ANSSI with military, intelligence and defense agencies. Its joint assessment places the refrigeration attack within Iranian-linked activity against French interests observed since at least 2020.
ANSSI cites attack-infrastructure characteristics, distinctive tools, traces of Persian in the infrastructure and amplification by a propaganda outlet linked to Shahid Kaveh as grounds for the October attribution. Paris prosecutors separately cited a characteristic attack method, Farsi use and IP addresses pointing to devices in Iran. These are the authorities’ stated grounds for attribution.
French investigators identify CyberAveng3rs and Cyber Isnaad Front among Shahid Kaveh’s purported hacktivist identities.
There is an earlier, independently documented warning about this type of exposure. In a December 2023 advisory notice, the U.S. Cybersecurity and Infrastructure Security Agency and partners said Revolutionary Guard-affiliated actors using the CyberAv3ngers persona were compromising internet-exposed, Israeli-made Unitronics industrial controllers through default passwords, including in U.S. water facilities. That precedent concerns different equipment and does not establish how the French refrigerators were compromised.
France also attributes earlier operations to a separate Revolutionary Guard-linked unit, Shahid Shoostari: the 2023 defacement and theft of data from satirical newspaper Charlie Hebdo’s online shop, carried out by Iranian entity Emennet Pasargad, and a 2024 intrusion into a French video-display operator. In the latter case, attackers sought to display manipulated images opposing Israeli athletes’ participation in the Paris Olympics, but the compromise was discovered before the images appeared. The record includes both successful disruption and an operation stopped before its intended public effect.
The accusation comes during the Iran war that began in February 2026. The report on the attribution describes the French sabotage as among that conflict’s most disruptive cyberattacks, but does not establish a specific motive for choosing French supermarkets.
Iran’s mission to the United Nations did not respond to requests for comment, according to the report on the attribution. Iran routinely denies conducting malicious cyber operations.
France attributed the October sabotage to Iran. Responsibility for the November 1–2 wave remains unresolved. Source: France Diplomatie.
Similar failures do not establish a common attacker
The French attacks had a possible precursor in the United States. Refrigerators at at least six military commissaries failed in August. A report on the U.S. investigation says Pentagon investigators were treating the failures as a suspected cyberattack and working with French officials. A person familiar with the matter said the Pentagon considered Iran a suspect, but the investigation remained open. The report could not establish the basis for that suspicion or whether other suspects were being examined. The Pentagon publicly acknowledged speculation about a potential cyber incident and declined further comment for security reasons.
The smaller attack affecting equipment from refrigeration-control supplier Dixell on October 12–13 has not been clearly attributed to the same operators in the available reporting. Responsibility for the November 1–2 refrigeration attacks across Europe and the contemporaneous targeting of France’s blood service, the Etablissement français du sang, likewise remains unresolved. A pro-Russian group claimed the later wave, but the report on the investigation noted that it supplied no screenshots or video demonstrating an intrusion or sabotage.
The attempted temperature increase at French blood banks was thwarted before blood products or samples were damaged, according to the report describing the October disruption.
Sanctions, warrants and securing remote controls
Paris prosecutors opened a formal judicial investigation on November 9 targeting Shahid Kaveh’s leader, two deputies and others who may be identified. They are seeking international arrest warrants in a case involving suspected organized cybercrime committed to serve a foreign power’s interests. Seeking those warrants is distinct from their issuance or the suspects’ arrest.
France has summoned Iran’s ambassador and says it will ask European partners to adopt new sanctions. Its foreign ministry points to EU sanctions imposed in March 2026 on Emennet Pasargad for its involvement in earlier cyber operations against France, and reserves additional public or non-public responses it considers necessary and proportionate. The November announcement describes a proposed further European response, rather than a newly adopted sanctions package.
The EU already has a framework for targeted sanctions over significant cyberattacks. In a May 2025 statement, the Council of the European Union extended the legal framework until May 2028 and described measures including asset freezes, prohibitions on providing funds to listed targets and travel bans for listed individuals. Those tools explain the potential financial and personal consequences; they do not establish which measures will emerge from France’s latest request.
For refrigeration operators, the immediate decision concerns access to their equipment. In an alert first issued October 12 and updated October 16, CERT-FR urged operators to remove public internet exposure, restore remote access only through a secure VPN or protected network, and apply manufacturer security practices. For equipment not compromised, it called for checking the full configuration, particularly defrost schedules. It also told operators to check insurance terms before cutting internet data feeds to refrigeration-service providers—a practical constraint on changing remote maintenance arrangements.
The next tests are whether European partners adopt France’s proposed measures, whether judicial requests lead to warrants, and whether investigators can establish who carried out the subsequent attacks.
Vates has patched an exploited Xen Orchestra login bypass, while its November 10 advisory leaves a separate VM import flaw unfixed. Administrators must also review delegated permissions and investigate possible host compromise.
CISA has listed exploited flaws in Openwave’s webmail document converter and Cisco’s BroadWorks communications platform, setting a November 24 federal remediation deadline. Openwave dates its fix to 2021; a separate research account links Cisco’s flaw to theft of telecom authentication keys.
Maersk confirms data theft from an acquired legacy system and disputes WhiteArmor’s password claims. The group demands $5 million while Maersk says it has found no impact on wider systems and expects no customer disruption.
Binance warns that malicious iPhone apps could use worse_query to read other apps’ files. A file manager built on the public code demonstrates cross-app access, but no cryptocurrency losses have been confirmed and the latest Apple updates have not been linked conclusively to a fix.
Microsoft fixed an actively exploited Outlook flaw that can disclose authentication information when a user opens a malicious file. The moderate-rated bug warrants priority within a November release exceeding 1,000 vulnerabilities, but the attackers and scale of abuse remain undisclosed.
Vanderbilt University allowed students and employees to resume using university devices Tuesday after ordering a shutdown Monday. Key services were available, but wider restrictions persisted and attackers’ claims of extensive data theft remained unconfirmed.
Barracuda says exploitation of recently disclosed vulnerabilities has affected a small number of organizations. Patches are available, and the two-flaw chain can give attackers root access to Email Security Gateway appliances with reachable administrative interfaces.
SAP’s November release addresses four flaws rated 10.0, including ICM2SHELL and PROXYGATE. Customers face unauthenticated routes into core business systems, and Gateway remediation can require configuration changes alongside patches.
Compromised Qubole credentials let an attacker assume customer AWS roles, harvest secrets and download data in October. Dormant integrations extended the exposure, while gaps in storage logs complicated efforts to establish what was stolen.
Google has fixed an actively exploited XML vulnerability in its Chrome desktop browser. The update brings this year’s exploited zero-day tally to eight, while details of the attacks remain undisclosed.
N-able took hosted N-central offline and urged customers running their own servers to do the same after public exploit disclosures. The shutdown interrupts a platform used to manage customer networks, while the scope of the flaws and a safe restoration date remain unresolved.
Trump nominated Palantir security chief Michael LoSapio to lead CISA, where workforce losses and a proposed funding reduction complicate the job as Senate control is set to change.
Iris Plaza says an intrusion into an external cloud service may have exposed data on 5.8 million current and former members and 1.9 million non-members. Its official shopping site remains suspended, while the actual extent of any leak is still under investigation.
Apple says three macOS updates stop bundled command-line tools from accepting compromised eMudhra certificates, extending protections already delivered to Safari and Mail. Apps with their own certificate lists still require separate checks.
Elliptic estimates that responders froze or seized 44% of the $6.43 billion stolen from Binance. Cross-chain services and screening gaps kept other funds moving, but most remaining value was still parked and little had likely been cashed out.
Researchers observed public proxy traffic exiting six addresses registered to the Executive Office of the President. The findings expose a possible route for outsiders to borrow government network identities, but do not establish access to internal systems.
Alpine Linux has patched a password-authentication bypass reachable through OpenSSH on systems using musl without PAM authentication. Under specific account and server settings, attackers can enter key-only accounts; some cloud instances can then give them root access.
Sekoia uncovered mobile data-theft tools delivered through compromised websites, cloned portals and Plerdy's analytics tracker. The analyzed attacks used already-patched flaws, and the report does not establish how many phones were infected.
Ryan James Roach has been extradited to face charges over alleged intrusions targeting US universities with supercomputers. Prosecutors allege credential theft and the diversion of university processing power for cryptocurrency mining; a second defendant remains in Canadian extradition proceedings.
